Re: Reading the message context of an encrypted soap message

[Ruchith Fernando <ru...@gmail.com>]

What is the order of your security actions?

If you have "UsernameToken Encrypt" as the security actions, which
will *first* add a UsernameToken and then Encrypt the message (body or
the specified parts) then when processing a received message wss4j
will be able to decrypt the message first and *then* invoke the
password callback invoking the password callback handler. Therefore
you will be able to access the decrypted message.

Thanks,
Ruchith

On 10/23/06, Dave Bagguley <da...@hotmail.com> wrote:
> Hello,
>
> Here is my situation: client A accesses service B.  Service B is protected
> by passwordcallback class C.  C needs to read the username and the method
> name from the soap message so that it can check with a database to see if
> client A has permission to access the method of service B.
>
> This works fine when I use UsernameToken to protect B. using:
> MessgageContext mc = MessageContext.getCurrentContext();
> String method = mc.getOperation().getName()
>
> However, when I use encryption instead of usernameToken, the
> passwordcallback class cannot read the MessageContext because it is
> encrypted.
>
> Does anyone know of a way around this?
>
> Thanks
>
> _________________________________________________________________
> Windows Live™ Messenger has arrived. Click here to download it for free!
> http://imagine-msn.com/messenger/launch80/?locale=en-gb
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
> For additional commands, e-mail: wss4j-dev-help@ws.apache.org
>
>


-- 
www.ruchith.org

---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org